We have a web application for which I've been asked to add the ability to let users upload documents that will then be visible and downloadable by other users. Those documents will typically be images and audit documents that will initially be in PDF format but may extend to other office formats in the future. Each user that can upload or download files will have to authenticate first. The servers run Debian.
The way I see it, with this functionality, our server can potentially become a distribution vector for viruses through the following scenario:
- User 1 uploads a file that contains a virus,
- Server makes the file available for download,
- User 2 downloads the infected file and propagates the virus.
In order to mitigate this threat, I was thinking of implementing a quarantine mechanism where every file is uploaded to our server in a safe folder, checked and only made available for download once all checks have passed. The security checks I had in mind are:
- Have a white list of file types we accept and reject any file not of that type,
- Check that the type of the actual file is the same as the one advertised in the POST request and reject any file where there is a mismatch,
- Run anti-virus on the file.
We may also include filters that are specific to given file types. For example, we could have images go through ImageMagick in order to store a "sanitised" version. Similarly, we should be able to partially parse document files to extract some information out of them and perform further checks.
My current ideas for implementing those checks are:
- Check the file type by using
- Use ClamAV as an anti-virus.
Are there other attack vectors I should think of or other checks I should implement?
Is ClamAV the correct tool to check files for viruses?
clamavto be too bad an idea compared to some expensive commercial products. I would just suggest an easy checking to protect your Windows users: after your
file -isuppress the files which extension doesn't correspond, suppress any file with multiple extension (ex.